In February 2024, Air Canada was ordered to pay damages to a passenger after its virtual assistant gave him incorrect information. The chatbot told the passenger he could buy a regular-price ticket from Vancouver to Toronto and apply for a bereavement discount within 90 days of purchase. But when the individual submitted his refund claim, the airline turned him down, saying that bereavement fares can’t be claimed after tickets have been purchased. The passenger took Air Canada to a tribunal in Canada, which said that the airline didn’t take “reasonable care to ensure its chatbot was accurate.”
Since ChatGPT’s launch in November 2022, there have already been a myriad of AI success stories, but there have also been many cases where harnessing artificial intelligence has gone horribly wrong. Without the right controls and oversight in place, enterprises encounter risks that create a host of unwanted consequences and threats to a company’s financial and reputational status. AI audits can unlock business value by bringing transparency, accountability, risk management, and human-centric design to the forefront of AI deployment.
AI’s Impact on the Business Landscape
But first, let’s set the scene. AI has played an increasingly important role in critical business functions in recent years. For example, many companies use AI for customer service chatbots, financial institutions leverage AI and machine learning (ML) to detect fraudulent transactions, and some organizations even use AI to forecast market trends and inform decision-making.
But, as with anything, organizations must consider the potential risks of AI. Several cases have been recorded where AI tools and chatbots made mistakes. AI systems also suffer from a lack of transparency, especially when used in a decision-making capacity. If stakeholders have little to no insight into how AI systems make decisions—as is often the case—it’s difficult to verify the prudence of those decisions.
As such, responsible and ethical AI use has fast become the topic of the moment. Governing bodies such as the EU have adopted AI regulations, privacy groups like EFF and EDRi have expressed serious concerns about AI and privacy, and world leaders have met to discuss AI safety. Following suit, consumers expect businesses to take ethical and responsible AI use seriously.
What does an AI Audit Entail?
An AI audit comprehensively evaluates an artificial intelligence system to ensure its reliability, fairness, and effectiveness. This process encompasses three main areas: technical assessment, algorithmic review, and governance evaluation.
Technical Assessment
The technical assessment phase of an AI audit typically involves testing:
- System Performance and Reliability – Examining an AI system’s accuracy, precision, recall, and other performance metrics to ensure it functions as expected.
- Security and Privacy – Evaluating a system’s resilience to cyber threats and its ability to protect sensitive data.
- Infrastructure and Scalability – Reviewing the underlying hardware and software infrastructure to ensure the system can scale efficiently without impacting performance.
Algorithmic Review
During the algorithmic review stage of an AI audit, auditors test algorithms for:
- Bias and Fairness – Examining data sets and algorithms to identify and mitigate biases.
- Transparency and Explainability – Ensuring the AI system’s decision-making processes are clear and understandable.
- Accuracy and Robustness– Stress-testing algorithms to understand their limits and behavior.
Governance Evaluation
Governance evaluation is the final stage of an AI audit. In this stage, auditors ensure the AI system and its operators:
- Meet Compliance and Ethical Standards – Reviewing the AI system’s adherence to relevant laws, regulations, and ethical guidelines, such as the EU AI Act.
- Demonstrate Accountability and Oversight – Assessing the frameworks in place for monitoring and controlling the AI system, including evaluating the roles and responsibilities of personnel and the mechanisms for reporting and addressing issues.
- Practice Comprehensive Documentation and Reporting – Ensuring comprehensive documentation of the AI system’s design, development processes, and decision-making rationale.
Obtaining Value from AI Audits
In today’s world where many locations have yet to develop and enforce AI-focused regulations or laws, it may be difficult to see the value in dedicating resources to AI audits. However, investing in AI audits can bring significant value even in the absence of mandatory requirements. Here’s why:
Proactive Risk Management
AI models and implementations are often prone to risks such as biases, data breaches, and algorithmic errors. Most organizations currently have a limited line of sight into how risk might impact their respective AI environments. An AI audit helps identify and mitigate these risks proactively which may in turn protect the business from potential issues and harm.
Building Customer and Consumer Trust
Customers and consumers are increasingly becoming concerned about the use of AI. This may be from an ethical, security, or privacy perspective. By conducting AI audits, a business can demonstrate a commitment to ethical practices and transparency, build trust with customers, improve the quality of products, and perhaps enhance brand reputation.
Operational Efficiency
AI audits may uncover inefficiencies within deployed AI systems. Being able to identify such issues and remediate them can lead to more optimized operations, reduced cost of resources, and improved productivity. Each of these can contribute to more sustainable, efficient, and effective use of AI.
Future-Proofing
While regulations may not be holistically enforced yet they are likely on the horizon. Of course, this may not lead to strong motivation now given the rapid enhancement to various AI technologies, however by starting now to conduct AI audits an organization will stay ahead of the curve. This will create a head start on controls that should be implemented, governance structures that will need iteration, and lessons-learned cycles that will ensure compliance with future regulations.